The ICO, the UK’s data protection regulator, issued a formal reprimand to the Metropolitan Police Service on 15 October 2026 over what it described as an “ongoing failure” to stop staff using unauthorised IT platforms. From March 2023, Met officers and staff created 500 accounts on Auror, a third–party platform used by retailers including Tesco, Boots, M&S, Greggs, Holland & Barrett and Home Bargains to track and deter shoplifting, and uploaded sensitive personal data about suspects — without central IT approval. They signed up after retailers sent them QR codes, which Auror Europe had branded with Met logos.
The ICO’s finding is pointed: the force “failed, and continues to fail, to implement appropriate technical and organisational measures” to make sure staff use of third–party online services is properly assessed, approved and overseen. It is also the second time. Around four years earlier, after staff were found using the unauthorised facial recognition app Clearview, the Met put measures in place that, the ICO noted, failed to stop the same thing happening again. For any UK business, the lesson is not really about policing. It is that a written policy does not stop people adopting a convenient tool when someone outside the organisation hands them a sign–up link — and that when 375 of 500 accounts are in active use, the tool was clearly useful, which is precisely why prohibition alone did not work.
What the ICO found
Auror, owned by a New Zealand company, lets retailers record and analyse shoplifting incidents using facial recognition, automatic number plate recognition and AI, and allows police officers with free accounts to share information with retailers about suspects. It is a legitimate product, and the Met now uses it under a formal contract. The ICO’s complaint is not about the tool. It is about how the force came to be using it: hundreds of individual sign–ups, initiated by retailers sending QR codes, with no central assessment of what data would be shared, where it would go or under what terms.
The data involved was sensitive. Through the platform, staff identified 179 unique individuals, of whom 59 were arrested, charged, convicted or had their details circulated as wanted. Shared information included suspects’ names, dates of birth, addresses and facial recognition references, and information on three under–18s. Officers’ own names, warrant numbers and email addresses were also shared — a detail that is easy to overlook, and a reminder that shadow IT exposes an organisation’s own people as well as the people it holds data about.
The ICO also found that the Met missed several chances to intervene. In June 2024, a request for mobile app access was approved by committee with no alerts raised. In August 2024, a security incident report flagged that staff were uploading suspects’ names to Auror. Only a second incident report, in September 2024, finally triggered restrictions. Each of those was a point at which someone inside the organisation had the information needed to act.
Finally, the ICO said the force had not shown that staff had read, understood or been regularly trained on its data protection policies. That finding matters because it describes the gap between having a policy and having a policy that works. The Met had rules. It could not demonstrate that the people they applied to knew them.
The force has since regularised its use of the platform. It signed a formal contract with Auror Europe in December 2025 and began operational use from January 2026, with officers now restricted from uploading or sharing data outside approved, controlled access. In other words, the eventual answer was not to ban the tool but to bring it under governance — which is usually how shadow IT is best resolved.
The mechanism in this case is one almost every UK business is exposed to. Someone outside the organisation — a supplier, a client, a partner — sends staff a link to a useful tool. Signing up takes a minute and needs only a work email address. Nothing in that process touches the IT department, and nothing in a written acceptable–use policy physically prevents it. If the tool is genuinely helpful, adoption spreads quickly and quietly, data flows into a platform nobody has assessed, and by the time anyone notices, hundreds of accounts exist. The Met had policies, had been through a near–identical problem with Clearview, and still ended up here. For a smaller organisation with fewer resources, the conclusion is not that staff are careless. It is that preventing shadow IT needs technical controls and a fast, easy route to get tools approved — because when the official path is slower than the unofficial one, people take the unofficial one.
How a sign–up link became a reprimand
The chronology below follows the ICO’s findings as reported. It shows not one failure but a series of moments at which the problem was visible and was not stopped.
The striking thing about that sequence is how many times the organisation had what it needed to act. A committee saw an access request. A security incident report named the problem. Neither was enough to stop it; a second report was. That pattern is common well beyond policing: early signals of shadow IT are often visible somewhere in the organisation, but nobody connects them, or the person who sees them does not have the authority or the process to do anything. A route that turns a single incident report into a decision is worth as much as any technical control.
What actually stops shadow IT
The chart below is an indicative planning model — not measured data — ranking common measures by how effectively they prevent staff adopting unapproved tools that handle the organisation’s data.
The top of the chart reflects how the Met’s case was eventually resolved. Staff were using Auror because it helped them do their jobs, and the durable fix was a formal contract with controlled access — meeting the need under governance rather than simply forbidding it. That is the lesson most organisations learn slowly: people adopt shadow IT to solve real problems, and if the approved alternative is absent or harder to use, prohibition loses.
The sixth bar is placed in the middle deliberately. The ICO specifically criticised the Met for not showing that staff had read, understood or been regularly trained on its policies, so training clearly matters — and the ability to evidence it matters to a regulator. But training on its own competes against a QR code that takes a minute to scan. It works best alongside the technical and process measures above it, not as a substitute for them.
Three in four accounts were in use — and that is the point
Divide the active accounts by the total and a revealing figure emerges.
A shadow IT problem that involves a few dormant accounts is a tidying–up exercise. One where three quarters of accounts are in active use is something else: evidence of real demand that the organisation’s approved tools were not meeting. That is a useful way for any business to read its own shadow IT. The question is not only “who broke the rules?” but “what were they trying to get done, and why did they not have an approved way to do it?”
The Met’s eventual response answers that question in the way most organisations eventually do. The force signed a formal contract and brought the platform into controlled use. The tool did not change; the governance around it did. Had that assessment and contracting happened at the start, the data would have flowed through an approved, controlled channel from day one, and there would have been no reprimand.
For a smaller organisation, the same dynamic shows up with file–sharing services, messaging apps, AI assistants, scheduling tools and free trials of all kinds. Staff adopt them because they help. If the organisation responds only with prohibition, usage goes quieter rather than away. If it responds by assessing the tool quickly and either approving it under sensible terms or providing an alternative that genuinely works, the data comes back under control.
Where UK businesses are exposed
The rows below reflect where shadow IT risk typically sits in a UK SME, with badges indicating how much attention each usually needs.
The seventh row is the Met’s exact route in, and it is common. Suppliers, clients and partners routinely invite staff onto their own platforms — portals, collaboration spaces, shared dashboards, booking systems. Each invitation is reasonable in isolation, and each one may involve your organisation’s data being entered into a service whose terms nobody has read. In the Met’s case, the invitations came from retailers, and the QR codes were even branded with Met logos by Auror Europe, which makes clear how easily an external invitation can look like an internal one.
The fifth row matters because it is exactly what the ICO highlighted: the Met had not shown that staff had read, understood or been regularly trained on its data protection policies. For a business, the practical step is simple. A policy that staff are asked to acknowledge, with brief periodic refreshers and a record of who has completed them, is both more effective and far easier to evidence than a document that sits on an intranet nobody visits.
What getting shadow IT under control costs
The bands below are indicative planning figures for UK businesses discovering and governing the cloud services their staff use — not quotes.
| Business profile | Typical scope | Indicative cost | What you get for it |
|---|---|---|---|
| Small business, under 15 staff | Ask staff what tools they use, check third–party app consents in your email platform, write a short approval route and acceptable–use note | £0 – £800 | A complete list of where company data actually goes, and a simple way for people to ask for new tools |
| SME, 15 – 100 staff | Discovery of cloud sign–ups and app consents, restriction of unapproved app access to company data, lightweight assessment process, acknowledged policy with refresher training | £2,000 – £10,000 | Visibility of shadow IT, technical guardrails, and evidence that staff understand the rules |
| Organisation handling sensitive personal data | All of the above plus data protection impact assessments for new tools, supplier contract review, incident escalation route and periodic audit | £8,000 – £30,000 | A defensible position if a regulator asks how staff use of third–party services is assessed and overseen |
| Business where a tool is already in widespread unofficial use | Assessment of the tool, contract and data processing terms, migration of existing accounts into a controlled set–up, communication to staff | £1,500 – £12,000 | The useful tool kept, under governance — the route the Met eventually took |
| Any business, immediately | Review which third–party apps have access to company email and files, and ask each team what external tools they rely on | £0 | An honest first picture of where your data has gone without anyone deciding it should |
The fourth row describes the situation many businesses will find themselves in once they look. A useful tool is already in widespread use, unofficially. Banning it outright usually just drives it out of sight. Assessing it, putting proper terms in place and moving existing users into a controlled set–up keeps the benefit and removes most of the risk — and it is considerably cheaper than discovering the problem through an incident or a regulator’s inquiry.
Two ways to respond to shadow IT
Reactive posture
Governance by policy document
- A policy that says staff must not use unapproved tools, with nothing technical behind it
- No visibility of which cloud services staff have signed up to with work accounts
- Third–party apps granted access to email and files by individual staff, unreviewed
- A slow, formal approval route that people avoid because it takes weeks
- Incident reports filed and noted, without a clear owner who can stop the activity
- No record that staff have read or understood the policy
- Each discovery handled as a one–off, so the same pattern repeats with the next tool
Proactive posture
Where virtual CIO oversight with Cloudswitched takes you
- Technical guardrails on app consents and sign–ups, so the policy is enforced rather than hoped for
- Routine discovery of the cloud services in use, reviewed on a schedule
- A fast, lightweight approval route that is easier than going around it
- Approved alternatives for the needs that drive people to unofficial tools
- Incident reports routed to someone with the authority to act the same day
- Acknowledged policies and short refreshers, with a record of completion
- Lessons from each discovery fed back into controls, so the next tool is caught earlier
The deepest difference between those columns is the last row. The ICO’s sharpest criticism was that measures introduced after Clearview failed to stop a near–identical problem with Auror. An organisation that treats each shadow IT discovery as an isolated breach of the rules will keep repeating the cycle. One that asks why the controls failed, and changes them, breaks it. That is the difference between a policy and a governance process.
The quickest way to find out what tools your organisation really uses is to ask, without blame. Tell staff you want a list of every external service they use for work — apps, portals, file–sharing sites, AI assistants, anything a supplier or client invited them onto — and that the goal is to make the useful ones official, not to punish anyone. Alongside that, check your email platform’s list of third–party apps that have been granted access to mailboxes or files, and look at any expense claims or card statements for software subscriptions. You will almost certainly find tools nobody approved. For each one that holds company or personal data, decide quickly: approve it with proper terms, replace it with something you already have, or retire it. Then publish a simple route for requesting new tools, with a promise of a fast answer. If the approved path takes a day and the unofficial one takes a minute, the unofficial one wins; if both are quick, most people will choose the one that keeps them out of trouble.
Why this is a governance problem, not a technology problem
It would be easy to read this case as a story about facial recognition, or policing, or one particular platform. The ICO’s own language points elsewhere. Its finding is about “appropriate technical and organisational measures” to ensure staff use of third–party online services is subject to proper assessment, approval and oversight. Every organisation that holds personal data has that same obligation, and most have the same gap between what their policies say and what their staff actually do.
The specific failure modes are all transferable. An external party inviting staff onto its platform. Sign–up requiring nothing more than a work email address. A tool genuinely useful enough that adoption spreads quickly. A formal approval process that saw the tool and did not grasp the data protection implications. Incident reports that named the problem without stopping it. And a previous incident whose lessons did not stick. A business does not need to be a police force to recognise those.
The virtual CIO role exists for exactly this kind of problem, which sits between IT, operations, data protection and leadership and is owned by none of them. Deciding which tools the organisation will officially support, how quickly new requests are answered, what technical guardrails are in place and how lessons from one incident change the controls for the next are all governance decisions. They are cheap to make deliberately and expensive to make by default, as the Met has now discovered twice.
For organisations pursuing Cyber Essentials, the relevant connection is user access control and the scheme’s emphasis on knowing what accounts and services exist. Staff accounts on unapproved third–party platforms, and third–party apps granted access to company email and files, are precisely the kind of access that escapes an organisation’s view. Bringing them into scope — and into the access review — closes a gap that certification alone may not reveal.
The story at a glance
| Item | Detail |
|---|---|
| What happened | The ICO issued a formal reprimand to the Metropolitan Police Service on 15 October 2026 |
| The platform | Auror, owned by a New Zealand company, used by retailers including Tesco, Boots, M&S, Greggs, Holland & Barrett and Home Bargains to track and deter shoplifting |
| What it does | Records and analyses shoplifting incidents using facial recognition, ANPR and AI; lets police with free accounts share information with retailers |
| How staff signed up | Retailers sent QR codes, branded with Met logos by Auror Europe, allowing sign–up independently of central IT approval |
| Accounts | 500 created from March 2023, of which 375 were actively used |
| Individuals identified | 179, of whom 59 were arrested, charged, convicted or circulated as wanted |
| Data shared | Suspects’ names, dates of birth, addresses, facial recognition references, information on three under–18s, and officers’ names, warrant numbers and emails |
| Missed chances | June 2024 app access approved with no alerts; August 2024 incident report flagged uploads; September 2024 second report finally triggered restrictions |
| Repeat failure | Measures introduced around four years earlier after unauthorised use of Clearview failed to prevent a recurrence |
| The ICO’s finding | The Met “failed, and continues to fail, to implement appropriate technical and organisational measures” for third–party online services |
| Training | The Met had not shown staff had read, understood or been regularly trained on its data protection policies |
| Resolution | Formal contract with Auror Europe in December 2025; operational use from January 2026 with controlled access only |
| The lesson | Policy alone does not stop staff adopting useful tools; technical controls, a fast approval route and approved alternatives do |
| Free first step | Review third–party app access to company email and files, and ask each team which external tools they use |
This story connects to several we have covered recently. The ICO’s £12.7m TikTok fine shows the same regulator’s attention to the gap between stated protections and working ones. The reporting on UK police data held on Microsoft Azure is another case of police data and third–party platforms, and of risk accepted without lasting oversight. The AI minister’s breach warning argues for an inventory of the AI tools staff connect to company systems — shadow IT by another name. OpenAI notifying 100–plus organisations about its agents is a reminder of how much depends on knowing what has access to your systems. The Supreme Court hearing on data protection claims shows how repeated small failures look different from one–offs. And the latest UK retail cyber–attacks involve some of the same retail sector at the heart of this case.
Do you know which outside services your staff have signed up to?
Most UK organisations cannot answer that with confidence — and the tools they cannot see are often the ones holding customer or staff data. Cloudswitched’s virtual CIO service helps businesses take control of shadow IT without stifling the people who adopt useful tools: discovering what is in use, putting technical guardrails on sign–ups and app access, creating an approval route that is quicker than going around it, and turning each discovery into a better control rather than a repeat of the last one.
Talk to us about Virtual CIO ServicesFrequently asked questions
Make the approved path the easy path
The Met had policies, had been through a near–identical problem before, and still ended up with 500 unapproved accounts holding sensitive data. The difference between a policy and a working control is whether it holds up when someone outside the organisation sends a convenient sign–up link. Cloudswitched works with UK businesses to close that gap: visibility of the services in use, guardrails on access to company data, a quick and sensible approval route, and a governance process that learns from each discovery instead of repeating it.
Talk to us about Virtual CIO Services
Cloudswitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
